Briefing
CISA added two AhsayCBS vulnerabilities to its Known Exploited Vulnerabilities catalog on October 14, 2026: CVE-2026-105133, an improper authentication flaw, and CVE-2026-105134, a command injection flaw. Huntress reported exploitation beginning October 7, with attackers running reconnaissance, dropping web shells and installing XMRig cryptominers masquerading as Microsoft Edge.
AhsayCBS is the management console for Ahsay backup software and is used mainly by managed service providers and system integrators. Ahsay released hotfixes on October 12: 10.3.4.45 for version 10 and 9.15.2.70 for versions 7, 8 and 9, according to Huntress.
Many businesses do not know which backup platform their provider uses. A compromised backup console can be used to delete or corrupt backups, which removes the recovery option a business would rely on after ransomware.
What to do
- Ask your provider which backup platform and version protect your data.
- If it is AhsayCBS, ask when the hotfix was applied and whether the server was checked for web shells and unknown processes.
- Ask whether the console is reachable from the internet and how administrative access is restricted.
- Ask whether at least one backup copy is immutable or offline, so it cannot be deleted from the console.
- Put the answers in writing and add them to your vendor risk file.
How to verify
- Request a test restore and record the result and the time it took.
- Check the CISA KEV catalog entries for the two CVEs and confirm your provider's response matches the required action.
- Review the backup job report for gaps or failed jobs since October 7.
Sources
- Huntress, Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer, Oct 2026
- CISA, CISA Adds Four Known Exploited Vulnerabilities to Catalog, Oct 14, 2026
- CISA, Known Exploited Vulnerabilities catalog
- CISA, #StopRansomware Guide
Want help putting this in place? Contact Computer Plus.